kubernetes/kops · error

error getting token: %v

Error message

error getting token: %v

What it means

Wraps tokenSource.Token() failure in getTokenInfo: the token source was built but minting/fetching an actual OAuth token failed — expired credentials, revoked refresh token, or OAuth endpoint unreachable.

Source

Thrown at upup/pkg/fi/cloudup/gce/gce_cloud.go:408

			continue
		}

		matches = append(matches, t)
	}

	return matches, nil
}

// logTokenInfo returns information about the active credential
func (c *gceCloudImplementation) getTokenInfo(ctx context.Context) (*oauth2.Tokeninfo, error) {
	tokenSource, err := google.DefaultTokenSource(ctx, compute.CloudPlatformScope)
	if err != nil {
		return nil, fmt.Errorf("error building token source: %v", err)
	}

	token, err := tokenSource.Token()
	if err != nil {
		return nil, fmt.Errorf("error getting token: %v", err)
	}

	// Note: do not log token or any portion of it

	service, err := oauth2.NewService(ctx)
	if err != nil {
		return nil, fmt.Errorf("error creating oauth2 service: %v", err)
	}

	tokenInfo, err := service.Tokeninfo().AccessToken(token.AccessToken).Do()
	if err != nil {
		return nil, fmt.Errorf("error fetching oauth2 token info: %v", err)
	}

	return tokenInfo, nil
}

// SplitServiceAccountEmail splits service account email

View on GitHub (pinned to 4c8573c808)

Solutions

1. Re-authenticate with gcloud
2. Check refresh token validity and OAuth endpoint reachability
3. Inspect the wrapped error

When it happens

Trigger: Thrown at upup/pkg/fi/cloudup/gce/gce_cloud.go:408 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/97867907d1b11f91. Report an issue: GitHub.